Privacy Policy

GrowBodi is operated by Peter Nielsen ("we," "us," "our"). For the purposes of the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven), Peter Nielsen is the data controller. You can reach us at support@growbodi.com.

GrowBodi is used by parents and legal guardians to build healthier habits for their child (ages 10–17). Accounts belong to the parent — there is no child login, no child-facing account creation, and your child does not access or control the account.

• Account information: your email address and a password. Passwords are hashed with a per-account random salt (scrypt) — we never store or have access to your plain-text password. Legal basis: performance of contract (GDPR Art. 6(1)(b)).
• Assessment information you provide about your child: an optional first name or nickname, age, sex (optional), activity level, sleep patterns, nutrition habits, a stated goal, and any limitations you tell us about (for example, an eating-disorder concern, a medical condition, an injury, or that your child is already under a doctor's care). Legal basis: your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), given when you create an account and enter this information.
• Ongoing use: daily habit-tracker entries, weekly check-in answers, and the resulting score history. Legal basis: performance of contract (GDPR Art. 6(1)(b)).
• Billing information (paid plans): handled directly by our payment processors (Stripe for web subscriptions, Google Play for Android subscriptions, Apple App Store for iPhone subscriptions). We receive confirmation that you're subscribed and a reference ID — we never see or store your card number. Legal basis: performance of contract (GDPR Art. 6(1)(b)).
• Technical information: our hosting and network providers (Vercel, Cloudflare) automatically log standard request data — IP address, browser/device type, and timestamps — for security and reliability. We use a single session cookie to keep you signed in (see "Cookies" below). If the app or site crashes, an error report (the error, device/browser type and app version — no names, emails, or health answers) is sent to our crash-reporting provider so we can fix it. Legal basis: legitimate interests in operating a secure, reliable service (GDPR Art. 6(1)(f)).
• Product usage: to learn which features help families, we record in our own database when you first complete key steps (sign-up, assessment, first habit ticked, viewing or starting a subscription), which days you use the app, and which version of the upgrade page you saw. This stays with us — no third-party analytics — and is deleted with your account. Legal basis: legitimate interests in improving the service (GDPR Art. 6(1)(f)).
• Test sign-ups (before launch): if you sign up on growbodi.com/test to test the Android app, we store the email address you give us, your first name if you add it, whether you have a kid aged 10–17, and your language. We use it only to put you on the tester list in Google Play Console and to send you the test link and a few messages about the test. If you create a GrowBodi account with the same address, it gets GrowBodi Plus free for testers. We delete the sign-up within a month of the public launch, or sooner if you ask. Legal basis: your consent (GDPR Art. 6(1)(a)).

GrowBodi uses a signed session cookie that keeps you logged in, and — only while kid mode is switched on — a second cookie that keeps the device locked to the child view. Both are strictly necessary and are not used for advertising, cross-site tracking, or analytics. We do not use any other cookies, pixels, or third-party tracking scripts.

Your answers are used only to compute your child's GrowBodi Score, priorities, and weekly habit plan, to generate an optional AI-assisted coach's note, and to show your child's progress over time. We use your account information to authenticate you, operate your subscription, and respond to support requests. We never use your data for advertising, never sell it, and never share it with other parents or families.

We do not sell your personal information or share it with data brokers or advertising networks. We share limited data with the following processors, each bound by a data processing agreement and used only to provide the service:

• Vercel and Cloudflare — hosting, content delivery, and network security (United States).
• Neon — database hosting for account and assessment data (United States).
• Stripe — payment processing for web subscriptions (United States).
• Google (Google Play) — payment processing for Android subscriptions (United States).
• Apple (App Store) — payment processing for iPhone subscriptions (United States).
• Sentry — crash and error reports, without names, emails, or health answers (United States / EU).
• Resend — transactional email delivery (password resets) (United States).
• NVIDIA — only for the AI features (the coach chat, weekly coach review and coach's note). We send your messages to the coach and a summary of your child's age, scores, plan and recent habit logs — never their name, your email, or any body measurements — to generate the reply (United States).

To suggest indoor or outdoor activities, our server looks up the current weather for the approximate area of your network connection (city level, rounded to about 1 km) from MET Norway (Norway). Only those rounded coordinates are sent — no account details — and they aren't stored.

We may also disclose data if required by Danish or EU law, court order, or other legal process, or to protect the rights, property, or safety of GrowBodi, our users, or others.

Most of the processors listed above are based in the United States. Transfers of personal data outside the European Economic Area (EEA) are governed by the EU Standard Contractual Clauses (SCCs) included in each processor's data processing terms, which provide appropriate safeguards under GDPR Chapter V.

The assessment and check-in answers you provide are about your child's general activity, sleep, and nutrition habits — they are not medical records, and GrowBodi is not a healthcare provider. Because this information may qualify as health data under GDPR Article 9, we process it only on the basis of your explicit consent (Art. 9(2)(a)). You may withdraw your consent at any time by deleting your account.

GrowBodi is not directed at children and does not knowingly collect personal information directly from a child. All information about your child is entered by you, the parent or guardian, through your account. If you believe a child has created a GrowBodi account without a parent's involvement, contact us at the address below and we'll delete it.

We keep your account and your child's assessment, plan, and habit history for as long as your account is active. When you delete your account (Account → Delete account), we delete your data from our production database immediately; residual copies may persist briefly in backups before being purged on our standard backup rotation. We do not retain deleted account data to train models, resell, or repurpose it.

As a data subject under GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing of your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.

You can exercise most of these rights directly from Account settings. For requests you cannot fulfil yourself, contact us at support@growbodi.com. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.

We use industry-standard measures to protect your information: passwords are hashed and never stored in plain text, session cookies are cryptographically signed, and all data in transit is encrypted with TLS. No system is perfectly secure. If we experience a security incident affecting your personal data, we will notify the relevant supervisory authority and, where required, you directly, within the timeframes required by GDPR.

If we make material changes to this policy, we will update the date above and notify you directly (for example, by email) before the changes take effect.

Questions about this policy, or a request to exercise your GDPR rights? support@growbodi.com